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In this paper we investigate the use of quantum information to share classical secrets. While 
every quantum secret sharing scheme is a quantum error correcting code, the converse is not true. 
Motivated by this we sought to find quantum codes which can be converted to secret sharing schemes. 
If we are interested in sharing classical secrets using quantum information, then we show that a class 
of pure [[n, 1, d]]q CSS codes can be converted to perfect secret sharing schemes. These secret sharing 
schemes are perfect in the sense the unauthorized parties do not learn anything about the secret. 
Gottesman had given conditions to test whether a given subset is an authorized or unauthorized 
set; they enable us to determine the access structure of quantum secret sharing schemes. For the 
secret sharing schemes proposed in this paper the access structure can be characterized in terms 
of minimal codewords of the classical code underlying the CSS code. This characterization of the 
access structure for quantum secret sharing schemes is thought to be new. 
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I. INTRODUCTION 

Quantum secret sharing schemes deal with the distri- 
bution of an arbitrary secret state among n parties (or 
shares) using quantum states such that only authorized 
subsets can reconstruct the secret. One can broadly clas- 
sify quantum secret sharing schemes into the category of 
schemes allowing one to (a) share quantum secrets and 
(b) share classical secrets. This paper focuses on schemes 
of the second category (b) . 

Quantum secret sharing schemes of both categories 
were introduced by Hillery, Buzek, and Berthiaume [l[. 
Classically, one can always associate an error-correcting 
code to a perfect secret sharing scheme — though deter- 
mining the access structure of the associated scheme is 
in general a very hard problem. Additionally, one can 
also derive a secret sharing scheme from a classical code, 
as was first illustrated by the work of Massey 0. It 
is not surprising therefore that one finds connections 
between quantum secret sharing schemes and quantum 
codes. The connection between quantum secret sharing 
schemes and quantum codes was first made explicit in 
the work of Cleve et al. 3 and in greater depth by 
Gottesman in Q. In fact Cleve et al Q showed that 
quantum threshold schemes can be derived from quan- 
tum MDS codes and gave an explicit method for these 
schemes. More recently, Rictjens et al. [Bj showed that a 
{{k, 2fc — 1)) quantum threshold scheme exists if and only 
if a [[2k — 1,1, k]]q quantum MDS code exists, thereby 
extending an earlier result found in 

However, the correspondence between quantum codes 
and quantum secret sharing schemes does not appear to 



* Electronic address: 
t Electronic address: 



pradeep@phas.ubc.ca| 



klappi@cs.tamu.edu| 



be as strong as in the classical case. In general, one 
cannot derive a perfect quantum secret sharing scheme 
from a quantum code. However, if we restrict our secrets 
to being classical, then we can relate a pure [[n, 1, d\] CSS 
code to a secret sharing scheme, as we will show below. 

Using quantum information to secure classical secrets 
has been studied earlier in P, 0, 0] • Gottesman had given 
a convenient characterization of the access structure of 
secret sharing schemes in Q- For the schemes proposed 
in this paper we provide an alternative characterization 
which can perhaps be extended to more quantum state 
sharing schemes. The access structures of the secret shar- 
ing schemes proposed in this paper can be characterized 
using the notion of minimal codewords, a concept which 
was introduced by Massey in the context of classical 
secret sharing. Additionally, we draw upon the work of 
Gottesman (H to link these ideas. 



A. Background: Quantum Secret Sharing 

Let the parties of a secret sharing scheme be P = 
{Pi, . . . , P„}. Any subset of P that can reconstruct the 
secret is called an authorized set. Subsets which cannot 
reconstruct the secret are called unauthorized sets. The 
collection of authorized sets is called the access struc- 
ture of the scheme and denoted by F. The collection of 
unauthorized sets is called the adversary structure and 
denoted by A. Clearly, F U ^ = 2^ , the power set of P. 
A minimal authorized set is one which can be used to 
reconstruct the secret but no proper subset of which can 
reconstruct the secret. Clearly any subset which contains 
a minimal authorized set is also authorized. The minimal 
access structure of the secret sharing scheme is the mul- 
tiset consisting of minimal authorized sets. We denote 
a secret sharing scheme with (minimal) access structure 
as (E, 
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Of course, the secret sharing scheme must specify more 
than the access structure. It must specify a means to 
encode the secret into the n different shares and how any 
authorized set can recover the secret. In the language of 
quantum error correction these two tasks translate into 
encoding and decoding of a quantum state which has 
been transmitted through a noisy quantum channel, in 
this case the quantum erasure channel. A secret sharing 
scheme is said to be perfect if 

i) an authorized set exactly reconstructs the secret 

ii) an unauthorized cannot extract any information 
about the secret 

Essentially, any perfect secret sharing scheme must sat- 
isfy two requirements. On one hand, there is the require- 
ment of secrecy; any unauthorized set must know noth- 
ing about the secret. On the other hand, there is the 
requirement of recoverability; any authorized set must 
be able to reconstruct the secret. One can also give a 
quantum information theoretic characterization of these 
requirements as was done in 0]. A characterization of 
these requirements for quantum secret sharing schemes 
can be found in [1], see also 0]. In particular, for clas- 
sical secrets this formulation is given as follows, see [1, 
Theorem 9] for details. 

Lemma 1 (Gottesman). Suppose we have a set of or- 
thonormal states \'4)i) encoding a classical secret. Then a 
set T is an unauthorized set iff 



where x G Fo, w 



, and j 



These operators 



(1) 



independent of i for all operators F on T . The set T is 
authorized iff 



for all operators E on the complement of T . 



(2) 



We can state these conditions more informally. For an 
unauthorized set T, there is no measurement that can 
be be performed on the qubits in the support of T that 
can extract any information about the states Since 
an authorized set T is to recover the secret, it can in 
effect correct erasures on the complement of T. If the 
conditions hold for any orthonormal basis of the space 
spanned by then these states can also be used for 
sharing quantum states, see for instance [1, Theorem 1], 
0, Theorem 7]. 

Remark 2. We need not consider all operators on T, 
we only need to consider a basis of the operators on T. 
For q-ary quantum systems schemes this basis of error 
operators can be identified with vectors in F^" . 

We assume some background in (nonbinary) quantum 
codes, the reader can refer to Q for more details. Let 
q be the power of a prime p. Let B = {\x) \ x € ¥q} 
denote an orthonormal basis for C*. For a,b E ¥q, we 
define operators X{a) and Z{b) by 



form a basis for error operators over a single qudit. Over 
n qudits, we define the error operator 

X{a)Z{b) = X{ai)Z{bi) (g) • • • ® X(a„)Z(6„) 

for a = (ai,...,a„) e F" and b = (6i,...,ab) e F^. 
The error operators £ ~ {X{a)Z{b) \ a,b £ F^} form a 
basis for error operators over n qudits. We shall often 
denote X{a)Z{b) by its representative over F^" as (a|6). 
We say that an error operator X{a)Z{b) has a support 
over T C {1, . . . , n} if (a*, 6t) ^ (0, 0) for all t G T, and 
{at,bt) = (0,0) otherwise. 



II. SHARING CLASSICAL SECRETS 

In this section we shall show that a pure [[n, 1, d\] CSS 
code can be converted into a secret sharing scheme. We 
shall also characterize the access structure of the scheme 
by using the notion of minimal codewords. Throughout 
this section we assume that the [[n, 1, d]] code under con- 
sideration has been derived from a classical code C 3 C"*" 
with the parameters [n, k, d]q whose parity check matrix 
is given as P]. The dual code is defined 

as C-^ = {a; g F^ I a; • c = for aU c G C}. The stabilizer 
(matrix) of the CSS code is given as 



" H 


" 





H 



(4) 



X{a)\x) = \x + a) Z{b)\x) 



Recall that the errors detectable by the CSS code arc in 
F2" \ (C e C) or C-L e , where C ® C is the dhect sum 
of C with itself. The undetectable errors are in (C0 C) \ 
©C-L). 

To define the minimal access structure of the secret 
sharing scheme we need the notion of minimal codewords. 
Let x,y € F^, then x is said to cover y if the support of 
X contains the support of y. Alternatively, yt is zero 
whenever = 0, where we assume that x = (xi, . . . , Xn) 
and y = (yi, . . . , y„). A codeword x G C is said to be a 
minimal codeword if 

i) its left most component is 1 and 

ii) it does not cover any other codeword of C except 
scalar multiples of x. 

A codeword which only satisfies ii) is said to be a minimal 
support. Every minimal codeword is of course a minimal 
support. Minimal codewords were first introduced by 
Massey in the context of classical secret sharing schemes, 
enabling a one to one correspondence with minimal au- 
thorized sets. Minimal supports play an important role 
in studying the local equivalence of stabilizer states. We 
also need the following lemma. 

Lemma 3. Let Q be a pure [[n, 1, d]]q CSS code derived 
from C C C F^''. For any two vectors x,y G C \ C'^ 
(3) we have x ■ y ^ 0. If q = 2, we have x ■ y = 1 and d odd. 



3 



Proof. Given the parameters of the quantum code the 
codes C and C"*" must have the parameters [n, k, d]q and 
[n,n — k = k — l,d\q respectively. Since C ^ C-^, it 
foUows that there is at least one vector c in C \ , that 
satisfies c • c ^ 0. Because dimC — dimC^ = 1 we infer 
that c and generate C. Therefore for any two vectors 
x^y in C \ C"^ we can write them as x ^ ac + and 
y = (3c + Sy for some Sx,Sy G C"*" and a, /3 G . Hence, 
x-y ^ (ac + s^)- (/3c + Sy) = a(3{c • c) ^ 0. If g = 2, 
then it follows that x ■ y = 1. In particular x ■ x = 1, 
which implies that the weight of x must be odd. Since 
the minimum distance depends on the weight of elements 
in C \ C-^, we conclude that d is odd. □ 

A. Proposed Secret Sharing Scheme 

First we shall describe the scheme and then show that 
it is indeed a valid secret sharing scheme. 

Theorem 4. Let Q be a pure [[n,l,d]]q CSS code de- 
rived from a classical code C C C . Let 8 he the 
encoding given by the CSS code 

E:\i)^ \^ + ^9) ^elF?, (5) 

where g G C\C^ and g-g = (3. Distribute the n qudits as 
the n shares for a secret sharing scheme, E. The minimal 
access structure r„i is given by 

Tm = {supp(c) \ c is a minimal codeword in C \ C^ }(6) 

Let c = ag + Sc be a minimal codeword for some Sc G C^ . 
The reconstruction for the authorized set supp(c) derived 
from c is to compute 

jesupp(c) 

where Sj is the share of the j th party. 

Proof. The proof of this theorem is a little long, so we 
shall break it into parts. First we shall show that the 
minimal codewords define authorized sets i.e., they can 
recover the secret. Next wc shall show that the associated 
authorized sets are minimal. Thirdly, we shall show that 
F is complete i.e., every minimal authorized set is in F. 

1) Recoverability: Let c be a codeword in C \ C^, not 
necessarily minimal. Then c can be written as c = 
ag + Sc for some Sc G C and a G ¥q . Adjoining 
an ancilla and computing the dot product with c = 

ag + Sc we get 

\0)\ig + C^) ^ ^ |c-a: + c-zg)|a; + i5), 

= Y \^'^~^'^9-W + Sc-i9)\x + ig), 



Since c,gG C \ C^ and x, Sc G C""- we have c ■ x = 
Sc'ig ^ 0. Let g ■ g = P, then by Lemma[31 /? ^ and 
is invertible in F,. It follows 

\0)\ig + C^) ^ |«/3z) Y + 

Since both a and P are known the secret can be re- 
covered from the ancilla which is in the state \a(3i). 
This proves that these subsets can reconstruct the se- 
cret and they indeed define authorized sets. So every 
code word in C \ can define an authorized set but 
it need not be minimal. Consequently every minimal 
codeword in C \ also defines an authorized set. 

2) Minimality of the authorized sets: Now let c be a 
minimal codeword. We shall show that in this case 
that any proper subset of supp(c) cannot reconstruct 
the secret. Let T be a proper subset of supp(c). Let 
the error operator E = (a|6) be supported in T where 
a,b G F^', then {a\b) cannot be a codeword in C © C. 
Suppose it were a codeword in C©C, then both a,b G 
C. Since E is nontrivial at least one of a and b is 
nonzero and covered by c, but then c would not be 
a minimal codeword. Therefore any error on T must 
be in F^" \ (C © C). But this means that any such 
operator is detectable by the quantum code Q. If it 
is detectable, then it must not reveal any information 
about the encoded states. In particular, it implies 
that T satisfies equation ([T]). Therefore every proper 
subset of supp(c) is an unauthorized set. This shows 
that supp(c) is a minimal authorized set. 

3) Completeness of Tm- Next wc show that all minimal 
authorized sets are in F^. Assume that there exists 
a minimal authorized set T which is not in F^ . Then 
T must satisfy equation Additionally, T fails to 
satisfy equation ([T|) while every proper subset of T 
being an unauthorized set does satisfy equation ([T]). 
This forces the existence of an operator E — {a\b), 
with supp(i?) = T, that violates equation ([T|). Now E 
cannot be in F^' \ (C© C) or C""- © C"*-, as these oper- 
ators are detectable and cannot violate equation ((T|). 
Therefore, E must be in (C © C) \ (C^ © C-^). Fur- 
ther, {a\b) G C ®C imphes that a,b G C. Now both 
a, b cannot be in C C as then (a|6) would be en- 
tirely in C^ © C^ and it would be detectable and 
cannot define an authorized set. So at least one of 
a,b is in C \ C^. Without loss of generality let us 
assume that a G C \ C^. But we already saw in 
step 1), that any codeword in C \ C^ defines an au- 
thorized set. So supp((a|0)) = supp(a) is itself an 
authorized set. Since {a\b) is a minimal authorized 
set, supp(a) = supp(a|6) = T. 

Suppose that a is not a minimal codeword. Then there 
is some vector in C that is covered by a and is not a 
scalar multiple of a. First we show that there exists 
no c? G C such that supp(c?) C T. If supp(d) was a 
proper subset of supp(a), then d cannot be in C \ C"*" 
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as it would then define an authorized set that is a 
proper subset of the minimal authorized set T. If d 
is in C^, then there exists a linear combination of a 
and d with support strictly a subset of T. Further this 
linear combination is also in C \ and by step 1) it 
would define an authorized set violating the minimal- 
ity of T. Therefore any d € C covered by a and not 
a scalar multiple of a must have supp(d) — T. But 
this implies that C contains a linear combination of a 
and d with support strictly less than T violating our 
previous conclusion that there exists no such element 
in C. Therefore a is a minimal codeword of C and 
it lies in C \ . (If the left most component of a is 
not 1 we can choose a scalar multiple of it so that it 
is 1. In any case, a and its scalar multiples have same 
support and they correspond to the same (minimal) 
authorized set). 

□ 

Since a codeword of minimum distance does not cover 
any other codeword, there always exists a scalar multi- 
ple of it which is a minimal codeword. Therefore, the 
minimal access structure always contains the sets corre- 
sponding to the support of the every minimum distance 
codeword in C \ . 

Corollary 5. In the secret sharing scheme specified in 
Theorem^ the support of every minimum distance code- 
word in C\ gives rise to a minimal authorized set. 

If g = 2, then wc can simplify the reconstruction pro- 
cess, we only need to take the parity of the parties in the 
minimal authorized set. 

Corollary 6. Let Q he a pure [[n, l,d]]2 CSS code de- 
rived from a classical code C"*" C C C . Let £ he the 
encoding given by the CSS code 



E 



E 



\x + ig) ie ¥2 



(8) 



where g € C \ C'^. Distrihute the n quhits as the n 
shares for a secret sharing scheme, E. The minimal ac- 
cess structure r,„ is given hy 

Tm = {supp(c) \ c is a minimal codeword in C\ }(9) 

The reconstruction for an authorized set is to simply com- 
pute the parity of the set (into an ancilla). 

The secret can be encoded using the encoding methods 
of CSS codes, see Reconstructing the secret for these 
schemes is extremely simple as shown below. We will 
need the multiplier gate M(c) and the generalized CNOT 
gate, A shown below. 



i) M(c) = lex) ,c e F^^ 
i\) A\x)\y) = \x)\x^^y)^ 
The recovery as given in equation ([7]) is computed by 
performing the following operation for each Cj 7^ 0. 



\S,) — ^3 



C3 













\anc) ® 

The final scaling by [afi)~^ can be done classically. 



B. Illustration 

We illustrate the strategy using a [[11, 1,3]] CSS code 
it can be derived from a code C with the following 
generator and parity check matrices. 
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(10) 



(11) 



Let us encode the secret 

|s> ^ ^ |c + se). 



(12) 



where e=[0000010010l]. The secret 
sharing scheme assumes that we distribute each qubit 
as a share. The minimal access structure of the secret 
sharing scheme is given by V^a ■ 



( {3, 10, 11}; {6, 9, 11}; {4, 7, 11}; {2, 5, 11}; ^ 
{1,8,11};{2,3,4,6,8}; 
{4,5,6,8,10};{1,3,4,5,6};{1,2,4,6,10}; 
r,„ = { {3, 4, 5, 8, 9}; {2, 4, 8, 9, 10}; {1, 2, 3, 4, 9}; 

{1,4, 5, 9, 10}; {3, 5, 6, 7, 8}; {2, 6, 7, 8, 10}; 
{1,2,3,6,7};{1,5,6,7, 10}; {5, 7, 8, 9, 10}; 
{2,3,7,8,9};{1,3,5,7,9};{1,2,7,9,10} 



It can be checked that the parity of any of these sub- 
sets will give s. Further, any subset that contains an 
element of Tm as a subset can also perform reconstruc- 
tion. Please note that this is not a threshold scheme, 
there exist minimal authorized sets of size three and five. 



i) ii) 

Their action on the basis states is given as: 



III. CONCLUSION 

In this paper we have given new methods to share clas- 
sical secrets using quantum information. We have been 
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able to strengthen the connection between quantum se- 
cret sharing schemes and quantum error correcting codes 
and given a new characterization of the access structure 
in terms of minimal codewords. This characterization 



is potentially of larger applicability, and its extension to 
additive quantum codes and quantum secrets will be ex- 
plored elsewhere. 
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